CVE-2026-13376
Full vulnerability record from the local CVENow database.
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
Severity
MEDIUM
CVSS score
4.8
(v4.0)
Vulnerability status
Modified
Source identifier
5d1c2695-1a31-4499-88ae-e847036fd7e3
Published
2026-07-03 00:16:51.497000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON
{
"id": "CVE-2026-13376",
"sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"published": "2026-07-03T00:16:51.497",
"lastModified": "2026-10-25T21:10:00.770",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071.\n\nThis issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2."
},
{
"lang": "es",
"value": "Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web (XSS o ’cross-site scripting’) vulnerabilidad en el módulo spamBlocker de WatchGuard Fireware OS permite XSS Almacenado. Esta vulnerabilidad es una ruta de ataque adicional sin mitigar para CVE-2025-1071.\n\nEste problema afecta a Fireware OS 12.0 hasta e incluyendo 12.12, 12.5 hasta e incluyendo 12.5.18, y 2025.1 hasta e incluyendo 2026.2."
}
],
"affected": [
{
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"affectedData": [
{
"vendor": "WatchGuard",
"product": "Fireware OS",
"defaultStatus": "unaffected",
"platforms": [
"Default"
],
"versions": [
{
"version": "2025.1",
"lessThan": "2026.2.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.0",
"lessThan": "12.12.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WatchGuard",
"product": "Fireware OS",
"defaultStatus": "unaffected",
"platforms": [
"EUCC"
],
"versions": [
{
"version": "12.0",
"lessThan": "12.11.9",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WatchGuard",
"product": "Fireware OS",
"defaultStatus": "unaffected",
"platforms": [
"T15/T35"
],
"versions": [
{
"version": "12.0",
"lessThan": "12.5.19",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-06T15:03:14.874446Z",
"id": "CVE-2026-13376",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.0",
"versionEndExcluding": "12.12.1",
"matchCriteriaId": "9FEF8DD4-1432-4109-967A-B03188988266"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E472917E-D6E1-4C2D-B37D-E76FCC7307CA"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9A8C7779-4466-4A9E-B191-929E7746DFF7"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6CE9A123-B769-4E56-845E-DC3DA6166C78"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:*",
"matchCriteriaId": "180FAE8C-2E73-4C09-AA11-0C82A7715FA3"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:*",
"matchCriteriaId": "309DBEF2-1D92-4641-827F-D99758B5FFA3"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D1E8CFC5-51FE-4D75-845F-D70C30AF11B0"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBFBA966-E052-4350-9544-3B5D484DBB6B"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF1E586D-0E88-447A-95E8-5203EF869ADB"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BC087C4-CB10-46D4-A746-0C462354410C"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59389EA2-3067-4AF8-AEC5-FE79E269C170"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "445FA7CD-D0AE-4176-9AE5-293B918DE654"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1B4A7366-0304-431E-B3E4-719BA575CEAC"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8512B4A-5269-4067-B9C6-475A4E8AD313"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:*",
"matchCriteriaId": "179C6166-87E1-44F8-B727-CDDE40C673D9"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:*",
"matchCriteriaId": "584107CC-6136-4AA1-AE68-73B93BDDB5B6"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9295217E-C1A0-4A69-A0F0-C44814BB376C"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7DC49246-2166-4681-8D67-4C0940884872"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CC853916-8BDC-4F7C-BA53-D6AB490A9444"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DCB1A254-DA3C-4032-B2C6-C9EBCE8EC15E"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D3562304-0317-4A3C-B622-D5CE01CC97F9"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:*",
"matchCriteriaId": "327BA50A-366A-4367-93B8-328EC0136FA7"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D92ABD52-20F6-4AB1-801F-9E7B7B1B78A1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3552F3BB-8021-4E87-987D-870699A7E619"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "158560A0-D694-41AF-A5F8-0F6FB3EFB8FA"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4ECAE1D7-9868-4730-B645-44CB1B6FDE96"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.1",
"versionEndExcluding": "2026.2.1",
"matchCriteriaId": "51B8E788-8FAF-4681-9750-488B2691F473"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*",
"matchCriteriaId": "615FF2CF-69DA-4890-9236-52D8D6FA0E71"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3439409-2FD6-447B-91CF-17D1C09E2A79"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0C0412F-AB02-4D13-B159-D0FCD2ECA3ED"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*",
"matchCriteriaId": "575CC5EE-0278-489B-AA95-5EC5058D6FB9"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5597F672-3C72-4BCF-AD3F-F16B6913EC2F"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8AAE66B-DD19-4C90-8DFC-F77BA1541642"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7FC18430-C6B4-4395-BFF1-83BB005875BA"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1A7C1C91-8B6E-4FB0-841E-7F88B06B1435"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8FE309D6-BD5E-4D18-91C3-A492C3576115"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "75959D39-0960-4836-96C7-DB8048DDE4B8"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D0087049-27C6-4B18-A645-72A8F63D7C6D"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.5",
"versionEndIncluding": "12.5.18",
"matchCriteriaId": "1DB41269-782A-463C-B257-335542B73093"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:*",
"matchCriteriaId": "626220F8-7F0C-4DD8-8001-12EA0A777A0D"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E561A57F-91A5-4B3C-9F7D-62E9AB5163A7"
}
]
}
]
}
],
"references": [
{
"url": "https://psirt.watchguard.com/CVE-2026-13376",
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"
},
{
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00018",
"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"tags": [
"Vendor Advisory"
]
}
]
}